12 KiB
Network Configuration
Our Puppet configuration management supports five types of network configuration:
- auto: NetworkManager does automatic configuration while respecting local user managed configuration
- auto_static_ip: static NetworkManager connection with IP from DNS and network information from DHCP
- managed: NetworkManger is fully managed via Hiera/Puppet
- unmanaged: network configuration (incl. DNS) is not touched by Puppet
- legacy: Puppet keeps network configuration untouched except for DNS configuration and applying
network::*Hiera settings
Not all types are supported by all RedHat versions:
| Type | RHEL7 | RHEL8 | RHEL9 |
|---|---|---|---|
| auto | - | ✓ | Default |
| auto_static_ip | - | ✓ | ✓ |
| managed | - | ✓ | ✓ |
| unmanaged | - | ✓ | ✓ |
| legacy | Default | Default | - |
Automatic Network Configuration
The automatic network configuration will just let NetworkManager do the work as it does it by default.
In Hiera you can select this option with
networking::setup: auto
And what does NetworkManager actually do by default? It attempts automatic configuration on all interfaces (DHCP, SLAAC). Additionally the user may add desired connections. This might be Wifi, VPN, but also normal Ethernet. Automatic configuration is only attempted if there is no such specific configuration.
DNS configuration as such is learned by autoconfiguration/manual connection configuration and will not be managed by Puppet.
Note that when changing to auto all legacy ifcfg files for network configuration are removed.
Automatic Network Configuration with Static IP Address
In a setup where there is just one static IP address which can be resolved via DNS, Puppet can configure a static connection with
networking::setup: auto_static_ip
Note this only works if there is a DHCP server in that network which provides the network mask and the default gateway IP address.
Managed Network Configuration
The network configuration can be fully and fine-grained be managed from Hiera with
networking::setup: managed
and the configuration for the individual connections:
networking::connections:
- psi_network
- management_network
networking::connection::psi_network:
interface_name: 'eno0'
ipv4_method: 'manual'
ipv4_address: '129.129.241.66/24'
ipv4_gateway: '129.129.241.1'
ipv6_method: 'disabled'
networking::connection::management_network:
interface_name: 'eno1'
ipv4_method: 'manual'
ipv4_address: '192.168.71.10/24'
ipv6_method: 'disabled'
So there is the list networking::connections which selects the network connections which should be configured.
Then for each connection name listed there needs to be a hash in Hiera named networking::connection::$CONNECTION_NAME.
If you have a fixed IP address which is in the DNS, you might also interpolate the ipv4_by_dns or the ipv6_by_dns variable:
networking::connection::psi_network:
mac_address: '00:50:56:9d:bb:ad'
ipv4_method: 'manual'
ipv4_address: '%{ipv4_by_dns}/24'
ipv4_gateway: '129.129.187.1'
ipv6_method: 'manual'
ipv6_address: '%{ipv6_by_dns}'
ipv6_gateway: 'abcd:1234::1'
The default value (if not specified) for `ipv6_method` is _auto_.
Ethernet Connection Definition
The default connection type is ethernet (alias for 802-3-ethernet).
The network connection hash needs to specify the NIC for the connection either by name with the key interface_name or by MAC address with the key mac_address.
Next you need to specify how IPv4 configuration should be done. The key ipv4_method supports the values auto, dhcp, manual, disabled, link-local. All except manual do not need further configuration. For manual the ipv4_address in the CIDR format "IP/network mask bits". For the default router has to be set with the key ipv4_gateway.
We did not look into IPv6 configuration yet and usually it is best to switch it off by setting ipv6_method to disabled.
To keep an interface down the setting state can be set to down (default is up).
You may also add additional configuration like size of the ring buffer:
networking::connection::psi_network:
...
additional_config:
ethtool:
ring-rx: 8192
ring-tx: 8192
The first key level is the section in the NetworkManager configuration file (on the command line usually the first part before the dot), the second key level is the name of the value to be set.
Infiniband Connection Definition
For infiniband connections the configuration is similar to ethernet. Additionally there is the type: 'infiniband setting accompanied by an additional_config key holding an infiniband key with the infiniband specific options, as you see in below example:
networking::connection::ipoib_network:
interface_name: 'ib0'
ipv4_method: 'manual'
ipv4_address: '192.168.1.16/24'
ipv4_gateway: '192.168.1.1'
ipv6_method: 'disabled'
type: 'infiniband'
additional_config:
infiniband:
mtu: 65520
transport-mode: 'connected'
Additional IP on Interface
Additionally to then normal first IP address on an interface you may also add additional addresses to a given interface:
networking::connections:
- psi_network
networking::connection::psi_network:
interface_name: 'eno0'
ipv4_method: 'auto'
ipv6_method: 'disabled'
additional_config:
ipv4:
address1: '192.168.254.254/24'
For more addresses just increase the counter after address.
MAC Address Spoofing
To change the MAC address used by the NIC set:
networking::setup: "managed"
networking::connection::psi_network:
interface_name: 'enp5s0'
ipv4_method: 'auto'
ipv6_method: 'disabled'
additional_config:
ethernet:
cloned-mac-address: '00:1b:21:22:d6:93'
!!! warning Duplicate MAC addresses in a local network ("collision domain") lead to network communication errors.
Other Connection Types
NetworkManager also supports other types like wifi, vpn, bridge, vlan, etc. Note that other types than ethernet and ethernet have so far not been tested. Please contact us if you managed to set up some other network type or need help to do so.
Interface Bonding
For bonded interfaces there is an own list named networking::bondings which defines which configuration defined in networking::bonding::$NAME hashes should be appled:
networking::bondings:
- bond0
networking::bonding::bond0:
ipv4_method: 'manual'
ipv4_address: '%{ipv4_by_dns}/24'
ipv4_gateway: '129.129.86.1'
ipv6_method: 'ignore'
slaves:
- 'eno5'
- 'eno6'
bond:
mode: '802.3ad'
xmit_hash_policy: 'layer2+3'
miimon: '100'
# optional
additional_config:
ethernet:
mtu: 9000
Feel free to extend the documentation here or provide a link for detailed explanation of the bond options.
By default the connection name is automatically used name of the bonding interface, Still, you can use speaking names instead for the connection if you specify the interface name explicitly:
networking::bondings:
- psi_network
networking::bonding::psi_network:
ifc_name: 'bond0'
ipv4_method: 'manual'
...
Usually Disconnected Interface
If you want to have an unconnected network interface preconfigured for later when it is needed, then Puppet will fail with the normal configuration as it tries to activate the interface:
'while test "$(gdbus introspect --system --dest org.freedesktop.NetworkManager --object-path /org/freedesktop/NetworkManager/Settings| wc -l)" -lt "3"; do sleep 1 ; done && /usr/bin/nmcli connection reload && /usr/bin/nmcli connection up 56b494dd-5437-55da-acb4-abc1e9ceeb27' returned 4 instead of one of [0]
There is the ignore state which allows to prepare an interface for the moment the cable gets connected, but it does not try to activate it immediately:
networking::connection::LOM:
state: 'ignore'
mac_address: 'bc:e9:2f:a6:60:46'
ipv4_method: 'dhcp'
ipv6_method: 'disabled'
Static Routes
Static routes can be added with the additional_config key in the connection settings.
Depending on the IP version there is a ipv4 or ipv6 subkey which then can contain many routes + number keys. So the first route is routes1, the second routes2, etc.
The minimal entry for routesX is the network and then, separated with a comma, the next hop IP. The optional third entry is the metric.
For each route you may also add a option key routesX_options, where multiple options in the form name=value can be added, again comma separated.
An example:
networking::connection::management_network:
interface_name: 'eno1'
ipv4_method: 'manual'
ipv4_address: '192.168.71.10/24'
ipv6_method: 'disabled'
additional_config:
ipv4:
routes1: '10.255.254.0/24,192.168.71.1'
routes2: '10.255.255.0/24,192.168.71.1,100'
routes2_options: 'lock-cwnd=false,lock-mtu=false'
All routing options can be found in the Red Hat NetworkManager documentation (RHEL8, RHEL9).
Removing a Connection
A connection does not get removed when its configuration has been removed in Hiera and was applied on the node.
To remove it you may do it manually or reboot.
Manual removal is done with nmcli connection down $ID/$CONNECTION_NAME:
[root@lx-test-dmz-01 ~]# nmcli connection
NAME UUID TYPE DEVICE
dmz_network f77611ac-b6e2-5a08-841e-8a1023eefaed ethernet ens33
ens35 f3ba4a81-8c9b-4aec-88ee-ddffd32f67fa ethernet ens35
[root@lx-test-dmz-01 ~]# nmcli connection down f3ba4a81-8c9b-4aec-88ee-ddffd32f67fa
Connection 'ens35' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2)
[root@lmu-user-dmz-01 ~]# nmcli connection
NAME UUID TYPE DEVICE
dmz_network f77611ac-b6e2-5a08-841e-8a1023eefaed ethernet ens33
[root@lx-test-dmz-01 ~]#
DNS Override
The internal nameservers are configured according to the network zone by Puppet.
If for some reason that is unsuitable, you might set your own in Hiera:
networking::nameservers_override:
- 192.33.120.5
- 192.33.121.5
No Automatic Migration to Legacy Configuration
Note that when changing to managed all legacy ifcfg files and all NetworkManager connections not reflected in Hiera are removed. So if you want to be able to go back to legacy mode you need to backup these files first.
Unmanaged Network Configuration
Here Puppet keeps the fingers off any network related configuration like interface configuration, DNS or routing.
In Hiera you can select this option with
networking::setup: unmanaged
When you change to unmanaged network configuration, the configuration on the node will stay as is.
Legacy Network Configuration
The legacy mode Puppet does not do configuration of network addresses and interfaces. This usually is done by the Kickstart file during OS installation and then not touched any more. Or with manual changes.
Additionally the network Puppet module can be used for more complex setups. But as this module is not maintained any more, we phase it out with RHEL9 and suggest to migrate away from it on RHEL8.
The legacy mode is selected by not setting networking::setup in Hiera.
Custom Nameservers
The internal nameservers are configured according to the network zone by Puppet.
If for some reason that is unsuitable, you might set your own in Hiera:
networking::nameservers_override:
- 192.33.120.5
- 192.33.121.5
Disable DNS Caching
Except for the unmanaged setup mode you may disable DNS caching with
networking::enable_dns_caching: false